Immigration and Refugee Board of Canada wrongly disclosed intimate and medical information to an employee’s management team via a fitness to work report
An employee of the Immigration and Refugee Board of Canada (IRB) complained that their intimate personal and sensitive medical information, contained in a Fitness to Work (FTW) report, was disclosed to their management team without consent and for no reasonable purpose. The OPC investigated whether the IRB respected section 8 of the Privacy Act, specifically regarding consent and consistent use. The IRB argued the disclosure was a consistent use, but the OPC found that while some information disclosure was consistent, the highly intimate personal and sensitive medical information was not. The OPC concluded that the IRB contravened the Act by disclosing information internally that fell outside what is permissible. Despite some new processes, the IRB did not fully acknowledge wrongdoing or agree to all recommendations, leading to a well-founded and unresolved finding.
- 1Whether the IRB obtained valid consent for the disclosure of the FTW report to the management team under section 8(1) of the Privacy Act
- 2Whether the disclosure of intimate personal and sensitive medical information in the FTW report to the management team was a 'consistent use' under section 8(2)(a) of the Privacy Act
- 3Whether the IRB adhered to the Treasury Board Secretariat's Occupational Health Evaluation Standard regarding disclosure of medical information to employers
- Disclosure of personal information: Disclosure of intimate medical information contravened the Act
- Consistent use: Disclosure of intimate medical information was not a consistent use
- Consent for disclosure: Disclosure without consent for intimate medical information was not permissible
- Compliance with recommendations: Institution did not agree to all recommendations
- Finding status: Complaint found well-founded and unresolved
Complaint well-founded and not resolved
The OPC found that the IRB failed to provide evidence of consent for the disclosure and that the disclosure of highly intimate personal and sensitive medical information was not a 'consistent use' under the Privacy Act, as it went beyond what was necessary for accommodation and violated applicable standards. The IRB did not fully agree to implement the OPC's recommendations.
The OPC recommended that the IRB delete the medical and other sensitive information from its systems, provide comprehensive training on medical confidentiality to relevant staff, and issue an apology to the complainant. The IRB partially accepted these recommendations, but not to the OPC's full satisfaction.
- s.8 Privacy Act
- s.8(1) Privacy Act
- s.8(2)(a) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro